@happyvertical/smrt-users 0.57.12 → 0.57.13

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as PermissionResolver, $t as GroupCollection, A as withSessionPermissionContext, At as recordTenantHierarchyChanges, B as resolveOidcProviderConfig, Bt as RoleCollection, C as OperationPermissionError, Ct as TenantCollection, D as getCurrentSessionPermissionContext, Dt as applyTenantHierarchyUpdates, E as hasOperationPermission, Et as TenantHierarchyError, F as OidcLoginError, Ft as deriveOperationPermissionSlug, G as DeviceCredentialForbiddenError, Gt as UsersPasswordCredential, H as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, Ht as UsersPinCredential, I as OidcLoginService, It as normalizeOperationPermissionAction, J as PIN_LOGIN_KIND, Jt as MembershipCollection, K as DeviceCredentialPolicyError, Kt as MembershipOverrideCollection, L as decodeOidcTransaction, Lt as registerPermissionDefinitions, M as MobileAuthService, Mt as RolePermissionCollection, N as readMobileBearerToken, Nt as PermissionCatalogService, O as getRequestScopedDatabase, Ot as assertTenantTableName, P as validateMobileRedirectUri, Pt as deriveOperationPermissionCollectionName, Q as SessionService, Qt as GroupMember, R as encodeOidcTransaction, Rt as syncPermissionCatalog, S as outOfBandProofSessionData, St as TenantPermissionOverride, T as checkOperationPermission, Tt as MAX_TENANT_HIERARCHY_DEPTH, U as DEFAULT_PIN_MANAGE_PERMISSION, Ut as PermissionCollection, Vt as UsersPinCredentialCollection, W as DeviceCredentialError, Wt as UsersPasswordCredentialCollection, X as PinVerifier, Xt as GroupRole, Y as PIN_PERMISSION_DEFINITIONS, Yt as GroupRoleCollection, Z as ensurePinPermissionsRegistered, Zt as GroupMemberCollection, _ as PasswordCredentialError, _n as Membership, _t as UserCollection, a as TerminalAuthError, an as UsersCliAuthRequestCollection, at as DEFAULT_SOURCE_LOCKOUT_AUDIT_SECONDS, b as PasswordPolicyError, bt as backfillUserEmailKeys, c as DEFAULT_PASSWORD_DENYLIST, cn as User, ct as LoginAttemptLimiter, d as DEFAULT_PASSWORD_MIN_LENGTH, dn as DEFAULT_SESSION_TTL, dt as ANCESTOR_READ_ACTION, en as Group, et as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, f as DEFAULT_PASSWORD_RECOVERY_MAX_AGE_SECONDS, fn as SESSION_DATA_KEYS, ft as DEFAULT_ANCESTOR_READ_MAX_DEPTH, g as PASSWORD_RECOVERY_MAX_AGE_CEILING_SECONDS, gn as Permission, gt as OidcProvisioningError, h as PASSWORD_PERMISSION_DEFINITIONS, hn as Role, ht as normalizeAncestorReadPolicy, i as TERMINAL_APPROVE_LOGIN_KIND, in as UsersLoginAttempt, it as DEFAULT_LOGIN_MAX_ATTEMPTS, j as MobileAuthError, jt as DEFAULT_ROLE_PERMISSION_PATTERNS, k as withPrincipalPermissionContext, kt as planTenantHierarchy, l as DEFAULT_PASSWORD_MANAGE_PERMISSION, ln as isValidEmail, lt as LoginRateLimitError, m as PASSWORD_MAX_LENGTH_CEILING, mn as generateSessionId, mt as isAncestorReadableSlug, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nn as UsersLoginAuditEvent, nt as DEFAULT_LOGIN_LOCKOUT_FACTOR, o as TerminalAuthRateLimitError, on as SessionCollection, ot as DurableLoginAuditSink, p as PASSWORD_LOGIN_KIND, pn as Session, pt as getConfiguredAncestorReadPolicy, q as DeviceCredentialService, qt as MembershipOverride, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rn as UsersLoginAttemptCollection, rt as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, s as TerminalAuthService, sn as UsersCliAuthRequest, st as InvalidCredentialsError, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tn as UsersLoginAuditEventCollection, tt as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, u as DEFAULT_PASSWORD_MAX_LENGTH, un as normalizeEmail, ut as withoutListBounds, v as PasswordCredentialForbiddenError, w as assertOperationPermission, wt as Tenant, x as ensurePasswordPermissionsRegistered, xt as TenantPermissionOverrideCollection, y as PasswordCredentialService, yt as UserEmailKeyBackfillError, z as getUsersOidcConfig, zt as RolePermission } from "./chunks/TerminalAuthService--oSXc4nT.js";
+import { $ as PermissionResolver, $t as GroupCollection, A as withSessionPermissionContext, At as recordTenantHierarchyChanges, B as resolveOidcProviderConfig, Bt as RoleCollection, C as OperationPermissionError, Ct as TenantCollection, D as getCurrentSessionPermissionContext, Dt as applyTenantHierarchyUpdates, E as hasOperationPermission, Et as TenantHierarchyError, F as OidcLoginError, Ft as deriveOperationPermissionSlug, G as DeviceCredentialForbiddenError, Gt as UsersPasswordCredential, H as DEFAULT_DEVICE_PERSON_IDLE_SECONDS, Ht as UsersPinCredential, I as OidcLoginService, It as normalizeOperationPermissionAction, J as PIN_LOGIN_KIND, Jt as MembershipCollection, K as DeviceCredentialPolicyError, Kt as MembershipOverrideCollection, L as decodeOidcTransaction, Lt as registerPermissionDefinitions, M as MobileAuthService, Mt as RolePermissionCollection, N as readMobileBearerToken, Nt as PermissionCatalogService, O as getRequestScopedDatabase, Ot as assertTenantTableName, P as validateMobileRedirectUri, Pt as deriveOperationPermissionCollectionName, Q as SessionService, Qt as GroupMember, R as encodeOidcTransaction, Rt as syncPermissionCatalog, S as outOfBandProofSessionData, St as TenantPermissionOverride, T as checkOperationPermission, Tt as MAX_TENANT_HIERARCHY_DEPTH, U as DEFAULT_PIN_MANAGE_PERMISSION, Ut as PermissionCollection, Vt as UsersPinCredentialCollection, W as DeviceCredentialError, Wt as UsersPasswordCredentialCollection, X as PinVerifier, Xt as GroupRole, Y as PIN_PERMISSION_DEFINITIONS, Yt as GroupRoleCollection, Z as ensurePinPermissionsRegistered, Zt as GroupMemberCollection, _ as PasswordCredentialError, _n as Membership, _t as UserCollection, a as TerminalAuthError, an as UsersCliAuthRequestCollection, at as DEFAULT_SOURCE_LOCKOUT_AUDIT_SECONDS, b as PasswordPolicyError, bt as backfillUserEmailKeys, c as DEFAULT_PASSWORD_DENYLIST, cn as User, ct as LoginAttemptLimiter, d as DEFAULT_PASSWORD_MIN_LENGTH, dn as DEFAULT_SESSION_TTL, dt as ANCESTOR_READ_ACTION, en as Group, et as DEFAULT_LOGIN_ATTEMPT_WINDOW_SECONDS, f as DEFAULT_PASSWORD_RECOVERY_MAX_AGE_SECONDS, fn as SESSION_DATA_KEYS, ft as DEFAULT_ANCESTOR_READ_MAX_DEPTH, g as PASSWORD_RECOVERY_MAX_AGE_CEILING_SECONDS, gn as Permission, gt as OidcProvisioningError, h as PASSWORD_PERMISSION_DEFINITIONS, hn as Role, ht as normalizeAncestorReadPolicy, i as TERMINAL_APPROVE_LOGIN_KIND, in as UsersLoginAttempt, it as DEFAULT_LOGIN_MAX_ATTEMPTS, j as MobileAuthError, jt as DEFAULT_ROLE_PERMISSION_PATTERNS, k as withPrincipalPermissionContext, kt as planTenantHierarchy, l as DEFAULT_PASSWORD_MANAGE_PERMISSION, ln as isValidEmail, lt as LoginRateLimitError, m as PASSWORD_MAX_LENGTH_CEILING, mn as generateSessionId, mt as isAncestorReadableSlug, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nn as UsersLoginAuditEvent, nt as DEFAULT_LOGIN_LOCKOUT_FACTOR, o as TerminalAuthRateLimitError, on as SessionCollection, ot as DurableLoginAuditSink, p as PASSWORD_LOGIN_KIND, pn as Session, pt as getConfiguredAncestorReadPolicy, q as DeviceCredentialService, qt as MembershipOverride, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rn as UsersLoginAttemptCollection, rt as DEFAULT_LOGIN_LOCKOUT_MAX_SECONDS, s as TerminalAuthService, sn as UsersCliAuthRequest, st as InvalidCredentialsError, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tn as UsersLoginAuditEventCollection, tt as DEFAULT_LOGIN_LOCKOUT_BASE_SECONDS, u as DEFAULT_PASSWORD_MAX_LENGTH, un as normalizeEmail, ut as withoutListBounds, v as PasswordCredentialForbiddenError, w as assertOperationPermission, wt as Tenant, x as ensurePasswordPermissionsRegistered, xt as TenantPermissionOverrideCollection, y as PasswordCredentialService, yt as UserEmailKeyBackfillError, z as getUsersOidcConfig, zt as RolePermission } from "./chunks/TerminalAuthService-BdLiwaaO.js";
 import { a as MembershipStatus, c as TenantPermissionEffect, i as DEFAULT_TENANT_POLICY, l as TenantStatus, n as DEFAULT_ROLES, o as OverrideEffect, r as DEFAULT_ROLE_SLUGS, s as SessionStatus, t as AccessRequestStatus, u as UserStatus } from "./chunks/types-DFqeph0R.js";
 import { ObjectRegistry, SmrtCollection, SmrtObject, SmrtRecipe, bumpChangeFeed, crossPackageRef, ensureChangeFeedTable, field, findManifestEntryByQualifiedName, foreignKey, isEmbeddedDatabase, isUniqueViolationError, registerRetentionTask, smrt, unregisterRetentionTask, withEmbeddedWriteTransaction } from "@happyvertical/smrt-core";
 import { TenantScoped, getTenantId, tenantId, withSystemContext, withTenant, withTenantGlobalRead } from "@happyvertical/smrt-tenancy";
@@ -2552,7 +2552,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService--oSXc4nT.js").then((n) => n.V);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-BdLiwaaO.js").then((n) => n.V);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -2581,7 +2581,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService--oSXc4nT.js").then((n) => n.V);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-BdLiwaaO.js").then((n) => n.V);
 		const key = await this.getSigningKey();
 		let payload;
 		try {

package/dist/manifest.json

@@ -2,7 +2,7 @@
   "version": "1.0.0",
   "timestamp": 0,
   "packageName": "@happyvertical/smrt-users",
-  "packageVersion": "0.57.12",
+  "packageVersion": "0.57.13",
   "objects": {
     "@happyvertical/smrt-users:AccessRequestCollection": {
       "name": "accessrequestcollection",

package/dist/smrt-knowledge.json

@@ -3,12 +3,12 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-users",
-  "packageVersion": "0.57.12",
+  "packageVersion": "0.57.13",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "b6fe1478dda5d662246bedf30e7f616d361a9afe79d1320eaa57d8b0d67a1f52",
-    "packageJson": "10a0c71f11cfc457b12ca1099dd3771ca12c512168ee32cd33324524b1839cf8",
+    "manifest": "ce527475b256587f350b6ad35ca8a78d5716f42f60fa7b0b6789bd7d52257c42",
+    "packageJson": "c64629fc1926cf07c25f1606cd60c3ff1412d48d82050c172586d9e774165e25",
     "agents": "c4ab6a1aae24c0fb687d4d02ef25dcb5e6942ad7e8318e9d0dd8d03d5750b788",
     "moduleDoc:agents/permissions.md": "02b2f03f0e057721369d9c693a624a6fdb3df4935401531a4373ff18229a64be",
     "moduleDoc:agents/oidc-provisioning.md": "b73f3fdaf61136720132a614c7e14237b7bd35f7bf5d43eabb29f565485803b9",

package/dist/sveltekit.js

@@ -1,4 +1,4 @@
-import { A as withSessionPermissionContext, B as resolveOidcProviderConfig, C as OperationPermissionError, F as OidcLoginError, G as DeviceCredentialForbiddenError, I as OidcLoginService, K as DeviceCredentialPolicyError, L as decodeOidcTransaction, M as MobileAuthService, N as readMobileBearerToken, P as validateMobileRedirectUri, Q as SessionService, R as encodeOidcTransaction, W as DeviceCredentialError, _ as PasswordCredentialError, a as TerminalAuthError, b as PasswordPolicyError, j as MobileAuthError, lt as LoginRateLimitError, o as TerminalAuthRateLimitError, q as DeviceCredentialService, s as TerminalAuthService, v as PasswordCredentialForbiddenError, y as PasswordCredentialService, z as getUsersOidcConfig } from "./chunks/TerminalAuthService--oSXc4nT.js";
+import { A as withSessionPermissionContext, B as resolveOidcProviderConfig, C as OperationPermissionError, F as OidcLoginError, G as DeviceCredentialForbiddenError, I as OidcLoginService, K as DeviceCredentialPolicyError, L as decodeOidcTransaction, M as MobileAuthService, N as readMobileBearerToken, P as validateMobileRedirectUri, Q as SessionService, R as encodeOidcTransaction, W as DeviceCredentialError, _ as PasswordCredentialError, a as TerminalAuthError, b as PasswordPolicyError, j as MobileAuthError, lt as LoginRateLimitError, o as TerminalAuthRateLimitError, q as DeviceCredentialService, s as TerminalAuthService, v as PasswordCredentialForbiddenError, y as PasswordCredentialService, z as getUsersOidcConfig } from "./chunks/TerminalAuthService-BdLiwaaO.js";
 import { DiscoveryArtifactValidationError, SMRT_APP_RESULT_CONTRACT, SMRT_APP_RESULT_SCHEMA, SMRT_APP_RESULT_VERSION, SMRT_DISCOVERY_CONFORMANCE_ARTIFACT_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_VERSION, SMRT_MCP_RESULT_METADATA_KEY, canonicalizeDiscoveryArtifact, createDiscoveryConformanceArtifact, deriveCommandRequirements, validateDiscoveryConformanceArtifact } from "./app-contract.js";
 import { ObjectRegistry, createClassNamePredicate, resolveCustomActionMetadata, resolveEffectiveActionMetadata } from "@happyvertical/smrt-core";
 import { createLogger } from "@happyvertical/logger";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-users",
-  "version": "0.57.12",
+  "version": "0.57.13",
   "smrtJsdoc": "strict",
   "description": "Multi-tenant user management for the SMRT framework - users, tenants, roles, permissions, groups",
   "type": "module",
@@ -49,18 +49,18 @@
   "dependencies": {
     "@happyvertical/auth": "^0.105.5",
     "@happyvertical/logger": "^0.105.5",
-    "@happyvertical/smrt-config": "0.57.12",
-    "@happyvertical/smrt-core": "0.57.12",
-    "@happyvertical/smrt-mobile-contract": "0.57.12",
-    "@happyvertical/smrt-profiles": "0.57.12",
-    "@happyvertical/smrt-tenancy": "0.57.12",
-    "@happyvertical/smrt-types": "0.57.12",
-    "@happyvertical/smrt-ui": "0.57.12",
+    "@happyvertical/smrt-config": "0.57.13",
+    "@happyvertical/smrt-core": "0.57.13",
+    "@happyvertical/smrt-mobile-contract": "0.57.13",
+    "@happyvertical/smrt-profiles": "0.57.13",
+    "@happyvertical/smrt-tenancy": "0.57.13",
+    "@happyvertical/smrt-types": "0.57.13",
+    "@happyvertical/smrt-ui": "0.57.13",
     "@happyvertical/sql": "^0.105.5",
     "jose": "^6.2.12"
   },
   "devDependencies": {
-    "@happyvertical/smrt-vitest": "0.57.12",
+    "@happyvertical/smrt-vitest": "0.57.13",
     "@sveltejs/package": "^2.5.8",
     "@sveltejs/vite-plugin-svelte": "^7.3.0",
     "@types/node": "24.13.6",